FAST REACTOR SAFETY

drhgfdjhngngfmhgmghmghjmghfmf

TANJU SOFUARGONNE NATIONAL LABORATORY

March 27, 2019Fast Reactor Technology TrainingU.S. Nuclear Regulatory Commission

OUTLINE

Design characteristics that impact safety FR accidents and their classification Approach for AOOs, DBAs, BDBAs, and severe accidents Important transient phenomena and fuel behavior Backup material

– Accident Types Comparison– SFR Event Descriptions– Evaluation of Phenomena

IMPACT OF SFR NEUTRONICS ON SAFETY

Fast energy spectrum requires finer multi-group cross-section structure to resolve neutron reactions Fast spectrum leads to ~10× longer neutron mean-free paths

– Negligible spatial self-shielding– Greater sensitivity to minor geometric changes due to enhanced neutron leakage– Reactivity perturbations impact the core as a whole, not locally

Complex reactivity feedback mechanisms (not just Doppler) Higher enrichment needed to achieve criticality with uranium cores

– Core is not in most reactive configuration and design must ensure recriticality(e.g., due to core compaction) does not occur

Long core life (even no refueling) with breed-and-burn concepts Pu-bearing fuels have lower effective delayed neutron fraction (βeff)

– Results in a lower margin to prompt criticality during reactivity transients– In breeder concepts (conversion ratio > 1), equilibrium core βeff can be

significantly reduced wrt beginning of life core Shielding challenges unique to fast neutron spectrum

THERMAL-FLUID DESIGN IMPACT ON SAFETY

Compact lattice (spacing is typically provided by a thin wire wrapped around each fuel pin) and high core power density (~up to 5X in comparison to an LWR) Large margin to liquid metal boiling

– Boiling should be avoided (can only be expected only during highly unlikely accidents with large-scale fuel failures)

Unpressurized primary and intermediate heat transport systems– No LOCA or need for high-pressure injection system (guard vessel--and guard

pipes in loop designs--to maintain coolant inventory High temperature operation (>500oC core outlet temperature)

– Material challenges due to thermal creep and fast fluence Large thermal inertia with long grace period Natural circulation potential

– ΔT is ~150oC during normal operation (>300oC during accidents) leading to significant sodium inlet/outlet density difference and large buoyancy

PLANT STATES CONSIDERED IN DESIGN

Operational states (NO and AOO): Handled via reactivity control system and BOP for heat sink Postulated accidents (DBA): Handled via safety-grade reactor shutdown system

and safety-grade DHRS Anticipated Transient Without Scram (ATWS): An AOO concurrent with failure of

reactivity control system BDBA: Multiple-failure accidents that are handled by

– Inherent safety (metallic fuel), or with addition of passive reactivity reduction devices (oxide fuel)

– Diverse commercial-grade DHRS– Typical BDBA event is an unprotected accident (a DBA initiator concurrent with

failure of reactor shutdown system)• Passive devices, if available, are assumed still available

In metal fueled pool-type designs, severe accidents (with core damage) can be pushed into the residual risk category

FAST REACTOR ACCIDENTS (1/2)

Loss of coolant: Reactor vessel (or primary piping leak in a loop-type SFR)– Due to external events of thermal-creep induced structural failures– Failure to mitigate could cause loss of decay heat removal function or core

uncovering• Highly unlikely due to reliance on guard vessel and guard piping

Loss of Flow (LOF): Pump failures or loss of pumping power– Due to electrical faults, mechanical faults (may result in pump seizure), loss of

piping integrity, operator errors, external events etc.– Requires flow coast-down for transition to natural circulation

Loss of Heat Sink (LOHS): Failures in power conversion or intermediate heat transport systems– Due to steam generator failure, turbine trip, IHTS failure (including IHX,

intermediate pumps or piping), loss of electrical grid load, operator error, external events etc.

– SFR designs include auxiliary decay heat removal systems that operate in active mode or based on natural convection (that do not require activation)

Events that lead to power generation vs. heat removal mismatch

FAST REACTOR ACCIDENTS (2/2)

Transient Overpower (TOP): Unintended increase in core reactivity– Possible causes are uncontrolled withdrawal of control or shutdown

rods/elements, overcooling (from accidental pump speed increase or operator error), sodium voiding in center of the core, seismically induced reactivity oscillations

– Postulated reactivity accidents do not include rod ejection/dropout, and fast neutron spectrum systems do not have Xenon burnout power changes

Flow blockage: In the core subchannels or elsewhere in PHTS or DHRS (such as freezing in the heat exchanger tubes)– Total instantaneous fuel assembly blockage is not a credible event in modern

designs with multiple inlet/outlet holes– Liquid metal coolants are highly tolerant of partial blockages but they should

be hypothesized and analyzed Station blackout: Simultaneous loss of off-site power to primary, intermediate,

and energy conversion system pumps

Events that lead to power generation vs. heat removal mismatch

APPROACH FOR AOO AND DBA

Like LWR, fast reactor safety is first based on utilization of multiple, redundant engineered protection systems to lower the probability of accident occurrence and limit its consequences:– Independent reactivity control and shutdown systems– Multiple coolant pumps and heat transport loops– Diverse decay heat removal systems– Multiple barriers to release of radioactivity

Unique LMR design features provide additional measures to protect these reactors during AOOs and DBAs:– Superb heat transfer due to high thermal conductivity of liquid metal coolant

(70 W/m-K for sodium vs. 0.6 W/m-K for water).– Large margin to coolant boiling (~350°C in SFR vs. ~20°C in PWR)– Large thermal inertia (long grace period during transients)

Analyzed using conservative approach or BEPU method

APPROACH FOR BDBA

Multiple-failure events that include ATWS (AOO followed by reactivity control system failure) or even a much less-likely unprotected event (a DBA followed by shutdown system failure) Measures to prevent these occurrences and mitigate their consequences should

also be considered in the design– Design features that enhance net negative inherent/passive reactivity

feedback and passive decay heat removal Independence and diversity of preventive design measures in Level 4 of DiD

(from those relied in Level 3) are advised– Due consideration of potential for common cause failures

Containment structure to prevent release of radioactivity to the environment as the last barrier (also against external events)– Sodium fires that could challenge the containment integrity needs to be

specifically addressed BDBAs are analyzed using best estimate method

APPROACH FOR SEVERE ACCIDENTS

Severe accidents are those that can cause propagation of fuel damage, potentially leading to loss of core integrity and coolable geometry Depending on the design choices and characteristics, they can be pushed under

the residual risk category– Inherent/passive safety characteristics and choice of fuel– Complex reactivity feedback mechanisms for LMRs– Supplementary passive reactivity control devices if needed– Proven capabilities during EBR-II inherent safety demonstration and FFTF

passive safety testing programs If the core damage cannot be prevented, in-vessel retention and core debris

coolability need to be assured– Reduce the potential impact on the containment function

Severe accidents that could lead to a significant and sudden radioactivity release has to be practically eliminated:– Simultaneous failure of the reactor and guard vessels– Complete loss of decay heat removal capability

APPROACH FOR RESIDUAL RISK EVENTS

Residual risk events (including the practically eliminated accident sequences) require off-site emergency planning and response Mechanistic source term (MST) assessments can cover a range of bounding

multiple-failure accidents:– Severe loss of decay heat removal capability– Severe loss-off-flow cases (multiple pump seizures)– Severe failures in spent fuel storage systems

MST development process:– Identification of radionuclide inventory and sources– Modeling of radionuclide transport pathways and phenomena– Evaluation of a class of bounding accidents

Other aspects of Emergency Planning and Response are similar to those employed for LWRs

INHERENT/PASSIVE SAFETY

Essence of the inherent/passive safety is to rely on intrinsic characteristics of the design to maintain a balance between generated heat and reactor cooling capability to prevent core damage when engineered safety systems fail The focus of inherent safety is to avoid:

– Large uncontrolled increases in core power– Insufficient cooling of the reactor core– Rearrangement of fuel that could lead to a recriticality

Inherent/passive safety uses three basic principles: – Favorable reactivity feedback (through core physics and structural design) – Sufficient natural circulation cooling for decay heat removal– Appropriate selection of fuel and cladding materials

REACTIVITY FEEDBACK MECHANISMS Doppler feedback: Effect of changes in neutron fission and absorption cross

sections due to Doppler broadening– Negative at temperatures above normal

Core radial expansion: Due to thermal expansion, irradiation-induced swelling, and irradiation-enhanced creep– Negative at temperatures above normal due to enhanced leakage

Fuel axial expansion: Effect of thermal expansion and transient swelling of especially the metallic fuels (and cladding)– Negative at temperatures above normal due to reduced number density of

fissionable isotopes Coolant density and void worth: Effect of changes in coolant density at elevated

temperatures– Can be positive due to reduced Na moderation/absorption, or negative due to

enhanced neutron leakage Control rod drive line expansion: Due to difference in thermal expansion of

control-ride driveline and reactor vessel– Can be positive or negative depending on CRDL expansion relative to reactor

vessel expansion

REACTIVITY FEEDBACK MECHANISMSEBR-II SHRT-45R Test Predictions:

WHAT TO LOOK FOR IN DESIGN REVIEW? (1/4)

Safety analyses are always concept specific and response of a design cannot be easily generalized; however, some fundamental principles apply: The design should employ a guard vessel (and guard piping loop type designs)

with enough capacity so that, in case of a leak, core remains covered and decay heat removal systems retain their function Reactivity control and shutdown systems should have sufficient reactivity to

secure a safe shutdown from the most reactive core state assuming failure of the highest-worth control assembly Decay heat removal system(s) should have sufficient capacity to avoid fuel

failures and assure integrity of primary coolant boundary (accurate assessment of decay heat level is important)– Unless separated by double barriers, residual heat removal system (RHRS)

coolant should be compatible with primary sodium coolant and kept at a slightly higher pressure so that leaks result in flow of RHRS coolant into the primary system

WHAT TO LOOK FOR IN DESIGN REVIEW? (2/4)

If a safety-grade RHRS is placed along the IHTS loop path, IHTS should also be a safety grade system– Otherwise, ITHS does not provide a safety function other than being a barrier

between PHTS and BOP– Unless separated by double-layer tubes in IHX, IHTS coolant should be

compatible with primary coolant and kept at slightly higher pressure so that IHX leaks result in flow of IHTS coolant into the primary system

Low pressure and single-phase conditions of the primary coolant system means that SFR containments can act only as a barrier But containment structure should have some pressure retaining capability

against the heat and pressure from a sodium fire– Inert compartments with steel liner are desirable– Should not contain any source of water that could ingress into RV– Protection against external events can be fulfilled through a hardened reactor

building that is not leak-tight Since containment isolation valves can interfere with reliability of DHRS and

IHTS functions, their use in lines penetrating the containment should be reconsidered through a risk assessment

WHAT TO LOOK FOR IN DESIGN REVIEW? (3/4)

Core vs. IHX elevation difference should be sufficient to facilitate effective natural circulation Core vs. DHRS heat exchanger elevation difference should also be sufficient to

allow passive decay heat removal if needed Pump coast-down should be sufficiently slow to avoid coolant boiling during the

early-phase of a LOF accident (when power-to-flow ratio is > 1) and it needs to be modeled accurately If design features in-vessel spent fuel storage, heat load from the stored spent

fuel should be included in the analyses Interference of active and passive systems

– Passive reactivity control systems may not be relied on if the pumps are still running

– Coolant can freeze if both BOP and DHRS are functional at decay heat levels Capturing the impact of passive system reliability in a risk assessment (may

require dynamic PRA techniques)

WHAT TO LOOK FOR IN DESIGN REVIEW? (4/4)

Fuel design limits for a given fuel/cladding combination should include the impact of “time-at-temperature”– Often captured in terms of “Cumulative Damage Fraction (CDF)”

Independence, and more ideally, diversity of design features at different levels of DiD is the key for a safe design, and it can be achieved in different ways:– Reactivity control

• Control system (AOO), shutdown system (DBA), inherent safety with ultimate shutdown system (BDBA)

• Control system (AOO), shutdown system (DBA), self-actuated shutdown system (BDBA)

– Decay heat removal• BOP (AOO), active mode DRACS (DBA), passive mode DRACS (BDBA)• BOP (AOO), active or passive mode DRACS (DBA), RVACS (BDBA)

Evaluation methodologies should be conservative or BEPU for AOO and DBA, and best estimate methods for BDBA For practically eliminated cases with no mitigation feature, a BEPU is

recommended to account for uncertainties against cliff-edge effects

METAL FUEL PERFORMANCE DURING ACCIDENTS WITH FUEL FAILURES

For metal fuel, scenarios that lead to temperatures sufficient to melt the fuel and/or fail the cladding do not result in blockages– Metal fuel has relatively low melting point and it forms eutectic alloys through

chemical interaction with the cladding (at temperatures well below the cladding melting point)

– Failures are predictably near the top of the fuel column– Temperature of the above core region is often at or above the melting point of

the relocating fuel/steel-eutectic mixture Transient over-power experiments at TREAT demonstrate that the fuel/steel-

eutectic mixture is carried well above core structure without blockages, resulting in early termination of rapid transient overpower and severe loss-of-heat-sink events– Experiments have not yet been performed for severe loss-of-flow conditions,

but simulations using phenomenological models predict similar early termination

SODIUM ACCIDENTS

Liquid sodium coolant reacts with air, water and concrete– Need be mitigated to avoid their impact on SSCs important to safety

Sources of sodium leakage inside of containment– Sodium from primary loop piping in a loop type SFR– Primary sodium from a sodium storage system (if any)– Primary sodium from purification system– Sodium from intermediate loop piping

Sodium accidents considered in licensing are– Primary leak with activated sodium fire– Intermediate sodium leak that may impact of safety function of SSCs– Steam Generator (SG) tube rupture

Implications of sodium fires– Containment atmosphere temperature and pressure– Impact of elevated temperatures on SSCs– Deposit of aerosols from sodium fires onto SSCs– Sodium-concrete reaction (could dehydrate concrete and produce hydrogen)– Integrity of IHTS from steam generator tube ruptures

SODIUM ACCIDENTS (2/2)

Phenomena involved in sodium leaks and resulting fires– Low pressure leak characterized by Na pouring onto the containment floor

causing a pool fire– High pressure leak characterized by dispersed sodium spray (use double-walled

piping inside the containment reduces this risk)– Oxygen availability/deficiency (inert cells in small isolated compartments help)– Sodium-oxide aerosol/smoke formation (can be an inhalation hazard and can

react with moisture in the air to form hydroxide that attacks metals)– Heat transfer to air and structures, resulting in increased containment

temperature and pressure Phenomena specific to pool fires

– Threshold temperature for onset of sodium burning in air (sodium near the freezing temperature might not even ignite)

– Surface combustion and oxygen transport to surface (often impeded by crust)– Pool surface area (burning rate is greater for larger pool area)– Heat transfer from surface to atmosphere and structures– Sodium-concrete interaction (usually prevented by use of steel liners)

DESIGN FEATURES FOR SODIUM FIRE MITIGATION

Leak detection sensors and systems (e.g., electrical contact, smoke detector) Shutting down the pump and draining the sodium from the affected loop to limit

the sodium mass released from a leak Double-walled piping with an interior inert atmosphere such that leaked sodium

from the first wall is contained in an inert atmosphere inside of the second pipe– Leaked sodium may be drained into a collection tank

Inerting of the compartments that house sodium components and piping “Sodium catch pan & fire suppression deck” to collect leaked sodium and limit

the sodium burn rate– Approach followed in CRBR, PRISM, and SAFR designs

Install drain pipes on thermal insulation surrounding sodium piping to collect leaked sodium and deliver it atop a sodium catch pan fire suppression deck – Eliminates formation of sodium jets and sprays from a leak

OTHER SODIUM ACCIDENTS

Sodium-Water Reaction (SWR) pressure relief system in each steam generator module– Protect against pressure pulse from postulated large SWR– Expel SWR reaction products into collection tank, and– Vent gas/vapor containing hydrogen formed from SWR through stack with

hydrogen igniter Other important mitigation measures:

– Isolate feedwater and steam lines from steam generator to terminate supply of water and steam through the leak

– Back fill steam generator through leak with an inert gas (e.g., nitrogen) to further suppress the potential for continued reaction

Sodium-water reaction mitigation

Steel liners on concrete floors and optionally walls to prevent direct contact between sodium and concrete

Sodium-concrete reaction mitigation

Backup Pages

CRBR SODIUM CATCH PAN & FIRE SUPPRESSION DECK

Air must pass through circular flow holes in steel plate reducing overall flow area and rate of oxygen transport to underlying surface of collected sodium pool– Reduces the rate of sodium burn, compartment atmosphere heatup, compartment

atmosphere pressure rise, and aerosol release into compartment atmosphere Buildup of sodium oxide reaction products atop sodium pool ultimately plugs flow

openings terminating sodium fire Inert MgO layer atop concrete protects and insulates concrete from contact with

sodium and heatup from sodium burning

KEY PHENOMENA (1/2)

Single-phase liquid-metal coolant flow and heat transfer Thermal inertia of coolant inventory Pump coast-down profiles Transition to natural convection core cooling Coolant stratification Core flow redistribution Decay heat profile Thermal creep of components and structures, in particular the coolant boundary Irradiation-induced creep of core support structure Cold-to-hot state reactivity changes Burnup reactivity swing Expansion of grid support plate and core radial expansion Expansion of control rod drives relative to expansion of reactor vessel

KEY PHENOMENA (2/2)

Impact of coolant impurities Steady-state and transient fuel performance Inter- and intra-assembly incoherence Doppler feedback and sodium density/void worth Reactivity implications of in-pin and ex-pin molten fuel motion Other consequences of fuel failures (potential for coolant boiling, molten fuel

refreezing resulting in coolant channel blockages and damage propagation) Sodium fires Sodium-concrete reactions Containment response to sodium fires, external hazards, and other loads

FAST REACTOR ACCIDENTS

ATWS: Anticipated transients without scram: An AOO combined with failure of reactivity control system Unprotected event: A DBA combined with failure of reactor shutdown system

(ULOF, UTOP, ULOHS events)

Multiple failure events involving reactivity control system failures

Statistical fuel failures due to fuel fabrication defects, fuel loading or enrichment errors etc.– Metallic fuel is compatible with sodium coolant and

local faults can be tolerated for an extended period with proper monitoring of fission gas release

– Demonstrated during the Run Beyond Cladding Breach tests at EBR-II with no fuel loss or significant liquid or solid fission product escape from fuel pin

Metal fuel (12 at-% burnup) after 5 ½ month-long RBCB Test

Local faults

Decay heat removal system failures Loss of flow with a pump seizure

Other multiple failure events involving safety grade systems

HOW TO AVOID CORE DAMAGE DURING UNPROTECTED EVENTS?

When shutdown system fails to scram the reactor, key early measure is to maintain the coolant temperature below its boiling point The net negative reactivity feedback (through inherent or passive means) should

eventually bring the reactor power into equilibrium with the available heat rejection rate as the system approaches an asymptotic temperature distribution– Long-term goal is to keep the asymptotic cladding, reactor vessel, support

structure temperatures below creep limits Avoiding core damage, therefore, depends on:

– Providing sufficient negative reactivity feedback to overcome the initial power-to-cooling mismatch, and

– Reducing the reactivity feedback components (mainly Doppler) that resist the return of the system to equilibrium temperatures

DESIRED RESPONSE TO ULOF EVENTS

Initiator is loss of power to the primary coolant pumps coinciding with failure of the plant protection system As core flow decreases, temperature rises and net negative reactivity feedback

reduces the power – As the power falls, the coolant outlet temperature also begins to decrease

with some delay With properly designed coast down of the primary coolant pumps, the coolant

boiling should be avoided with substantial margin in the short term With properly sized passive decay heat removal systems, longer-term transient

temperatures should be kept below the levels at which load-stress-induced creep could result in structural failures

DESIRED RESPONSE TO UTOP EVENTS

Typical initiator is an uncompensated withdrawal of a single, maximum-worth control rod (or bank of rods) In a metallic-fueled core with a low cycle burnup reactivity swing, the withdrawal

of a single rod typically amounts to an insertion of smaller amount of reactivity in comparison to oxide systems Reactor power rises above nominal, followed by a heating of the core and the

coolant which should introduce sufficient negative reactivity to return the reactor power gradually to equilibrium with the assumed nominal heat rejection at the steam generators The low control rod worth in a core with a metallic fuel is an advantage in

comparison to oxide fuel core

DESIRED RESPONSE TO ULOHS EVENTS

Feedwater supply to the steam generators is lost with simultaneous failure of the plant protection system, resulting in a gradual heating of the intermediate and primary coolant systems and an increase in the core inlet temperature Heating of the core support grid spreads the core radially, introducing key

negative reactivity feedback (in addition to Doppler) that should reduce the reactor power In the long term, the reactor power should equilibrate with any available heat sink

as the inlet temperature remains elevated above its initial steady-state value – Peak temperature should be well below boiling point– Asymptotic temperature should be below levels at which load-stress-induced

creep could result in structural failures

MECHANISTIC SOURCE TERM ASSESSMENTS (1/2)

Attempts to realistically assess the transport/retention and release of radionuclides from the plant for specific scenarios Allows for an accurate representation of the many radionuclides barriers present

in a metal fuel, pool-type SFR Important for reduced emergency planning zone and smaller site boundary

For scenarios with core damage, an MST assessment is needed

MST utilizes scenario-specific information:– Burnup level of fuel batches– Timing of accident scenario– Conditions of fuel pin failures– Conditions of the primary sodium, cover

gas region, and containment– Design information regarding leakage

from reactor vessel head and containment

MECHANISTIC SOURCE TERM ASSESSMENTS (2/2)

Radionuclide inventory in each fuel batch at the time of accident Migration of radionuclides within the fuel

pin during irradiation Release of radionuclides from failed fuel

pins, including entrainment in bubbles within the pool Removal of aerosols/vapors from bubbles

due to “scrubbing” in pool

MST assessments involve many steps that coincide with radionuclide transport pathways

Release of radionuclides to the cover gas region from bubbles and vaporization from sodium pool Radionuclide aerosol behavior in the cover gas region and containment Chemical interactions of sodium vapor/aerosols with O2 and steam Leakage from the cover gas region and containment